Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

routes/web.php

@@ -0,0 +1,61 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Http\Controllers\Auth\PireonAuthController;
+use App\Http\Controllers\DocsController;
+use App\Http\Controllers\LocaleController;
+use Illuminate\Support\Facades\Route;
+
+Route::redirect('/', '/admin');
+
+/*
+|--------------------------------------------------------------------------
+| Authentication — Pireon OAuth2 (Authorization Code + PKCE)
+|--------------------------------------------------------------------------
+|
+| `login` is the page Filament bounces guests to; it renders a single button
+| that starts the flow at `auth.redirect`.
+|
+*/
+
+// Laravel's own "unauthenticated" redirect targets a route named `login`;
+// point it at the panel's login page so both agree on one screen.
+Route::redirect('/login', '/admin/login')->name('login');
+
+Route::middleware('guest')->group(function () {
+    Route::get('/auth/redirect', [PireonAuthController::class, 'redirect'])
+        ->name('auth.redirect');
+
+    Route::get('/auth/callback', [PireonAuthController::class, 'callback'])
+        ->name('auth.callback');
+});
+
+Route::post('/logout', [PireonAuthController::class, 'logout'])
+    ->middleware('auth')
+    ->name('logout');
+
+/*
+|--------------------------------------------------------------------------
+| Locale switching
+|--------------------------------------------------------------------------
+*/
+
+Route::get('/locale/{locale}', LocaleController::class)->name('locale.switch');
+
+/*
+|--------------------------------------------------------------------------
+| API documentation
+|--------------------------------------------------------------------------
+|
+| Browsable docs for both APIs, rendered from public/openapi.yaml. Readable
+| without signing in on purpose: the people who need it most are writing the
+| public frontend and have no reason to hold a panel account, and the
+| specification describes endpoints rather than secrets.
+|
+| To keep it to the collective instead, wrap this route in the `auth`
+| middleware and move openapi.yaml out of public/.
+|
+*/
+
+Route::get('/docs/api', DocsController::class)->name('docs.api');